internal/capability/probe.go Check() uses os.Stat(kvmPath) to check KVM
availability. This passes for any existing file (the success test literally
creates a plain temp file to stand in for /dev/kvm) and would also pass on a
real /dev/kvm node with permissions that make it unopenable by the agent
(e.g. group mismatch). Spec (openspec add-imp-kvm-install-preflight) says
"verified KVM ... capability" — Stat verifies existence, not usability.
Fix: os.OpenFile(kvmPath, os.O_RDWR, 0) (close it immediately) instead of
os.Stat. Update the existing success/missing-device tests accordingly; add a
permission-denied case if easy to simulate (chmod 000 on the temp file, skip
if running as root/CI where perms don't apply).
Not currently blocking anything — /dev/kvm doesn't exist at all on any node
we've tested against (see #33 and omni-on-unraid#7), so this only matters
once a real KVM-capable node is available to test the positive path.
internal/capability/probe.go Check() uses os.Stat(kvmPath) to check KVM
availability. This passes for any existing file (the success test literally
creates a plain temp file to stand in for /dev/kvm) and would also pass on a
real /dev/kvm node with permissions that make it unopenable by the agent
(e.g. group mismatch). Spec (openspec add-imp-kvm-install-preflight) says
"verified KVM ... capability" — Stat verifies existence, not usability.
Fix: os.OpenFile(kvmPath, os.O_RDWR, 0) (close it immediately) instead of
os.Stat. Update the existing success/missing-device tests accordingly; add a
permission-denied case if easy to simulate (chmod 000 on the temp file, skip
if running as root/CI where perms don't apply).
Not currently blocking anything — /dev/kvm doesn't exist at all on any node
we've tested against (see #33 and omni-on-unraid#7), so this only matters
once a real KVM-capable node is available to test the positive path.